digest: flush state on origin or credential change

[bagder]

Verified by test 1686

[testclutch]

Analysis of PR #21944 at bc4ccf4a:

Test 3102 failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 12 different CI jobs (the link just goes to one of them). Note that this CI job has had a number of other flaky tests recently (2, to be specific) so it may be that this failure is rather a systemic issue with this job and not with this specific PR.

Test 503 failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 2 different CI jobs (the link just goes to one of them). Note that this CI job has had a number of other flaky tests recently (2, to be specific) so it may be that this failure is rather a systemic issue with this job and not with this specific PR.

Test 853 failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 2 different CI jobs (the link just goes to one of them). Note that this CI job has had a number of other flaky tests recently (2, to be specific) so it may be that this failure is rather a systemic issue with this job and not with this specific PR.

Generated by Testclutch

[icing]

nice!

[Copilot]

Pull request overview

This PR fixes HTTP Digest authentication state handling by resetting cached Digest state whenever the request origin (host/port) or credentials change, preventing reuse of stale Digest nonces/responses across different destinations or users. It adds a new regression test (1686) to validate the correct authorization handshake across multiple origins and a credential switch.

Changes:

• Flush per-origin Digest auth state when the connection origin changes.
• Flush Digest auth state when credentials change mid-session.
• Add new libtest + test data (test 1686) covering multi-origin Digest plus credential switching.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/libtest/Makefile.inc	Adds lib1686.c to the libtest build bundle.
tests/libtest/lib1686.c	New libtest driving Digest auth across two origins and then changing credentials.
tests/data/test1686	New test definition verifying the expected request/Authorization sequence.
tests/data/Makefile.am	Registers test1686 so it runs as part of the test suite.
lib/vauth/digest.c	Ensures Digest cleanup releases linked origin and creds references (non-SSPI).
lib/vauth/digest_sspi.c	Ensures Digest cleanup releases linked origin (SSPI path).
lib/urldata.h	Extends struct digestdata with linked creds + origin tracking.
lib/http_digest.c	Implements the “flush on origin/credential change” logic and tracks origin/creds in Digest state.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.